   ;; RFC 6749 4.1. Authorization Code Grant (A)
   (solicit-access-token [this req scopes]
     (let [original-uri (absolute-uri req)
-          ;; We need a session to store the original uri
-          session (create-session!
-                   (:session-store this)
-                   {:original-uri original-uri})
-          state (str (java.util.UUID/randomUUID))]
+          state (str (java.util.UUID/randomUUID))
+
+          ;; 4.1.1.  Authorization Request
+          response (let [loc (str
+                        (:authorize-uri this)
+                        (as-query-string {"response_type" "code" ; REQUIRED
+                                          "client_id" (:client-id this) ; REQUIRED
+                                        ; "redirect_uri" nil ; OPTIONAL (TODO)
+                                          "scope" (encode-scope
+                                                   (union (as-set scopes) ; OPTIONAL
+                                                          (:required-scopes this)))
+                                          "state" state ; RECOMMENDED to prevent CSRF
+                                          }))]
+               (debugf "Redirecting to %s" loc)
+               (redirect loc))
+
+         ]
+      ;; We need a session to store the original uri
 
       (expect-state this state)
-      ;; 4.1.1.  Authorization Request
-      (cookies-response-with-session
-       (let [loc (str
-                  (:authorize-uri this)
-                  (as-query-string {"response_type" "code" ; REQUIRED
-                                    "client_id" (:client-id this) ; REQUIRED
-                                    ; "redirect_uri" nil ; OPTIONAL (TODO)
-                                    "scope" (encode-scope
-                                             (union (as-set scopes) ; OPTIONAL
-                                                    (:required-scopes this)))
-                                    "state" state ; RECOMMENDED to prevent CSRF
-                                    }))]
-         (debugf "Redirecting to %s" loc)
-         (redirect loc))
-
-       APP-SESSION-ID
-       session)))
+      (create-and-attach! (:browser-session this) req response {:original-uri original-uri})
+
+
+      ))
 
   (expired? [_ req access-token] false)
 
   UserIdentity
   (get-claims [this req]
-    (let [app-session-id (get-session-id req APP-SESSION-ID)]
-      (-> (get-session (:session-store this) app-session-id) :open-id)))
+    (when (exists? (:browser-session this) req)
+      (get-data (:browser-session this) req :open-id)))
 
   ;; TODO Deprecate this!
   TempState

   [modular.bidi :refer (WebService)]
   [cylon.oauth.client :refer (AccessTokenGrantee UserIdentity solicit-access-token)]
   [cylon.authorization :refer (RequestAuthorizer)]
   [cylon.session :refer (->cookie get-session assoc-session! create-session! cookies-response-with-session get-session-value get-session-id purge-session!)]
   [ring.middleware.cookies :refer (wrap-cookies cookies-request cookies-response)]
   [ring.util.response :refer (redirect)]
   [ring.middleware.params :refer (wrap-params)]


  AccessTokenGrantee
  (get-access-token [this req]
    (when (exists? (:browser-session this) req)
      (get-data (:browser-session this) req)))

  (solicit-access-token [this req]
    (solicit-access-token this req []))
